Chore(deps): bump github.com/ProtonMail/gopenpgp/v2 from 2.3.0 to 2.4.9

[dependabot]

Bumps github.com/ProtonMail/gopenpgp/v2 from 2.3.0 to 2.4.9.

Release notes

Sourced from github.com/ProtonMail/gopenpgp/v2's releases.

Release version 2.4.9

Upgrade underlying go-crypto version

Release version 2.4.8

Add AEAD decryption support

Release version 2.4.7

• DecryptMIMEMessage will return the decrypted content in the OnBody callback, even when there's a signature verification error. That lets the caller decide whether they want to use the content with a warning or hard fail on signature errors.
• Key generation functions no longer return an error if either the name or email is empty

Release version 2.4.6

Fix MIME signature parsing issues

Release version 2.4.5

Deprecate SeparateKeyAndData, replace with (msg *PGPMessage) SplitMessage() to split PGP messages

Release version 2.4.4

Clone returned slices from SeparateKeyAndData

Release version 2.4.3

Security

• Fixed incorrect MDC parsing for session key decryption

Changed

• SeparateKeyAndData is now implemented in a more generic way, by checking for the location in the bytes of the last session key packet, then splitting the binary message after that point.

Fixed

• SeparateKeyAndData now correctly parses AEAD packets.
• (ap *AttachmentProcessor) Finish() now returns encryption errors correctly.

Release version 2.4.2

Update underlying crypto library and prevent AEAD messages from being created until the specification is stable

Release version 2.4.1

Fixed bug with NewPGPSplitMessageFromArmored(armored) and PGPMessage.SeparateKeyAndData(). Those functions didn't parse AEAD encrypted messages correctly (eg messages encrypted with the latest versions of gnupg), resulting in a nil DataPacket.

Release version 2.4.0

Update underlying crypto library and add functionality to get the signature timestamp of a verified signature

Release version 2.3.1

Fix the verification of PGP/MIME message signatures:

• Improve the handling of the dual verification status so that it is considered invalid if both embedded and PGP/MIME signatures are invalid.
• start calling callback.OnVerified(status int) to communicate the status verification of the message.

Changelog

Sourced from github.com/ProtonMail/gopenpgp/v2's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[2.4.8] 2022-06-22

Changed

• SessionKey.Decrypt() and SessionKey.DecryptAndVerify(), now support the decryption of AEAD encrypted data packets (packet type 20).

[2.4.7] 2022-04-27

Changed

• DecryptMIMEMessage will return the decrypted content in the OnBody callback, even when there's a signature verification error. That lets the caller decide whether they want to use the content with a warning or hard fail on signature errors.
• Key generation functions no longer return an error if either the name or email is empty

[2.4.6] 2022-03-25

Fixed

• Update dependency github.com/ProtonMail/go-mime. It makes the parsing of MIME messages more flexible to messages with no specified charsets.
• Fix the verification of PGP/MIME signature, the signature is now verified against the canonicalized content rather than the raw content.

[2.4.5] 2022-03-01

Added

• (msg *PGPMessage) SplitMessage() to split PGP messages, replacing SeparateKeyAndData.

Changed

• SeparateKeyAndData is now deprecated.

[2.4.4] 2022-02-28

Changed

• SeparateKeyAndData clones the returned byte slices to avoid overwriting.

[2.4.3] 2022-02-24

Security

• Fixed incorrect MDC parsing for session key decryption

Changed

• SeparateKeyAndData is now implemented in a more generic way, by checking for the location in the bytes of the last session key packet, then splitting the binary message after that point.

Fixed

• SeparateKeyAndData now correctly parses AEAD packets.
• (ap *AttachmentProcessor) Finish() now returns encryption errors correctly.

... (truncated)

Commits

• 3278880 Merge pull request #194 from ProtonMail/update-go-crypto
• a065bf2 Update go-crypto
• 1791c07 [codespell] Fix typos (#190)
• 7fa8280 Release version 2.4.8
• 59c4bf0 Merge pull request #187 from ProtonMail/feat/session_key_aead_decryption
• 139e421 update changelog
• 373e1ad Add unit tests for decryption of aead packets
• 4cea9a0 Decrypt AEAD encrypted data packets with a session key
• 22acd6e Merge pull request #185 from ProtonMail/improve-ci
• fee9ec1 Improve golang CI
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

The following labels could not be found: automation.

[dependabot]

Superseded by #101.